This vulnerability is an authorization flaw (CWE-863) in the Actor component of Google Chrome for Android. A malicious renderer process, once compromised, can craft an HTML page that forces Chrome to bypass site isolation. The result is that the renderer may access data or resources belonging to other sites, potentially leaking information or enabling cross‑site attacks. The Chromium team rated the security severity of the issue as low, but the possible data exposure remains noteworthy for affected users.

Google Chrome users on Android devices running any pre‑155.0.8059.39 build are affected. The flaw exists in older stable channel releases and is mitigated in Chrome 155.0.8059.39 and later.

The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The CVSS score is 8.2, indicating high severity. Attackers would need to have already compromised the renderer process on the device; based on the description, the likely attack vector is a malicious renderer executing crafted HTML. This inference is drawn from the stated condition in the CVE description and is not directly stated in the input. Given the availability of an update that resolves the issue, the risk can be effectively mitigated by applying the vendor fix.